[ Reason ]
9 open CVE issues in trixie that are fixed in testing.

[ Impact ]
Users are vulnerable to the security issues.

[ Tests ]
I (sponsor) have only build-tested this on amd64.
The submitter may have done additional tests and I have
asked him to submit additional details.

[ Risks ]
(Discussion of the risks involved. E.g. code is trivial or
complex, alternatives available.)

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
This includes the upstream patches from the stable 3.10 tree that
are marked to fix the CVEs and apply cleanly on the trixie version.

Thank you Bastian for filing this patch request. This patch series should address the request in bug#1142507.

I've built, locally, a new package with this patch series and I'm currently running it successfully on my deployment. The stack is stable and I did not observe any regression as a result of these patches.

I did not try to explicitly reproduce nor test the bugs described in the CVSs beyound the unit tests attached to the patches provided.

Please let me know if you need any additional info. Thank you.

Hi Release Team,

Update / ping on this issue: trixie is still vulnerable to all nine
CVEs, and the upload has not been made. Attached is an updated debdiff
against 3.10.2-1+deb13u1 (current version in trixie-proposed-updates).

The maintainer, Xavier Guimard, has reviewed and merged this into the
packaging repository:
https://salsa.debian.org/debian/cyrus-imapd/-/merge_requests/14

Changes since the debdiff Bastian posted on 2026-07-28: DEP-3 metadata
on all nine patches, and the upstream Cassandane regression tests that
the original omitted (it carried tests for only three of the nine
fixes).

* Risks
Low. All nine are upstream fixes cherry-picked from 3.10.3, each adding
a single missing ACL check (or a bounds check, for CVE-2026-47088). No
packaging, ABI or configuration changes. Diff is +1065/-0, confined to
debian/changelog, debian/patches/series and nine new patches.

* Tests
Built in a clean trixie chroot (sbuild) on amd64. No runtime testing was
done: Each fix ships its upstream Cassandane regression test, but those
are not exercised yet, because the autopkgtest pulls the archived
upstream cassandane repo rather than the in-tree suite (#1145447, being
fixed separately).

Fixed in unstable since 3.12.3-4.

Thank you,

     Edmund

Control: tags -1 + confirmed

Please go ahead.

Regards,

Adam

package release.debian.org
tags 1142925 = trixie pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian trixie.

Thanks for your contribution!

Upload details
==============

Package: cyrus-imapd
Version: 3.10.2-1+deb13u2

Explanation: fix insufficient access check issues [CVE-2026-47084 CVE-2026-47086 CVE-2026-47087 CVE-2026-47081 CVE-2026-47089 CVE-2026-47085 CVE-2026-47083 CVE-2026-47082]; fix out of bounds read issue [CVE-2026-47088]

package release.debian.org
tags 1142925 = trixie pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian trixie.

Thanks for your contribution!

Upload details
==============

Package: cyrus-imapd
Version: 3.10.2-1+deb13u2

Explanation: fix insufficient access check issues [CVE-2026-47084 CVE-2026-47086 CVE-2026-47087 CVE-2026-47081 CVE-2026-47089 CVE-2026-47085 CVE-2026-47083 CVE-2026-47082]; fix out of bounds read issue [CVE-2026-47088]

We believe that the bug you reported is fixed in the latest version of
cyrus-imapd, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1142925@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Edmund Lodewijks <edmund@proteamail.com> (supplier of updated cyrus-imapd package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 02 Aug 2026 12:00:00 +0200
Source: cyrus-imapd
Architecture: source
Version: 3.10.2-1+deb13u2
Distribution: trixie
Urgency: medium
Maintainer: Debian Cyrus Team <team+cyrus@tracker.debian.org>
Changed-By: Edmund Lodewijks <edmund@proteamail.com>
Closes: 1142925
Changes:
 cyrus-imapd (3.10.2-1+deb13u2) trixie; urgency=medium
 .
   * Backport security fixes from upstream 3.10.3 (Closes: #1142925)
     (https://www.cyrusimap.org/imap/download/release-notes/3.10/x/3.10.3.html):
     - CVE-2026-47084: LOCALDELETE bypassed ACL checks, allowing non-admin
       users to delete mailboxes without permission.
     - CVE-2026-47086: GENURLAUTH issued URLAUTH tokens without checking
       ACL_READ on the target mailbox.
     - CVE-2026-47087: URLAUTH tokens kept working after the authorizer's
       access was revoked.
     - CVE-2026-47081: XAPPLEPUSHSERVICE allowed probing for mailbox
       existence and hijacking push notifications on other users' folders.
     - CVE-2026-47089: LISTRIGHTS was not restricted to users with admin
       access on the target mailbox.
     - CVE-2026-47085: URLAUTH tokens could be forged via a predictable
       empty mboxkey.
     - CVE-2026-47083: MULTISEARCH/ESEARCH allowed a cross-user folder and
       content enumeration oracle.
     - CVE-2026-47088: heap out-of-bounds read when parsing nested MIME
       comments in RFC 822 headers.
     - CVE-2026-47082: vacation "fcc" delivery skipped the ACL check on the
       destination mailbox.
   * This revision adds DEP-3 metadata to the new patches and restores
     upstream Cassandane regression tests that were missing from the initial
     debdiff (thanks, Codin!) for several of the fixes.
Checksums-Sha1:
 9b29f38e162e342f38ea7d6661f2970dc1cc9c7e 5929 cyrus-imapd_3.10.2-1+deb13u2.dsc
 dbc6b67d0312a2167391f47846e23f17ff67395d 97480 cyrus-imapd_3.10.2-1+deb13u2.debian.tar.xz
Checksums-Sha256:
 945f3a727f5cd80e29b516e8348e187037c6e9f34f28b2a7627db78fa5cc9938 5929 cyrus-imapd_3.10.2-1+deb13u2.dsc
 b285bbd0fd42e0ff6d1895bbc42c949c13ea69484c4698110040024632613880 97480 cyrus-imapd_3.10.2-1+deb13u2.debian.tar.xz
Files:
 f5a359cfe0ac159cb925f2287c510195 5929 mail optional cyrus-imapd_3.10.2-1+deb13u2.dsc
 6335d306251e4db60d468ff099d41773 97480 mail optional cyrus-imapd_3.10.2-1+deb13u2.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmqa0IYACgkQ9tdMp8mZ
7ukw9g/+K22V6xuhTaM/uCA6iNHtD+Jnp6iKtZnsJ0l4VlMcoSVufXGEgFkOPPTm
bDk0QKF7K92b/TQ/YIJe38ueNGwwCAwUo529l7CX6c+m3pc5rrOk4LB/+HbE+ixb
jwC2uiKuBQjSb2NvXB+h3PJFFtO/1QPUA4JWEABAGWbgK9LVHT+RRP0Xy905b515
FUYjusBqJFBtm+VxWrpHka3423Wv1+7cAO2UTq1vnHgP1nd/EzofR5rJWZ5Yfuhu
8k4eO9+seWftbAXHvdKNge3gU7pgtxC4yjfNaTgVUKoua8NQR7f5rCCXrRX8Fk2Q
e5orDP1q6qJbxl5f8JgXtj66DXRZJxXPchgCWusEqT2H5YgZzTbTHyJ1iev0Uj2g
RIKA2cSojimaNh3m0s2sZmUPsOukdgjeluDoF0vzyR0JN7LryvdgKMgtimAU1UQD
g48Ci7D4PKx3FVzqTXMkHYmcNgOoBHtQPAG2vfrXC9VZAuF7s1Do0VZPxT7DjJJT
Saz9y9d0xf2PBWapS5OYVzFETPS/OIspXoWGlJ7fykyI018wz3a54kEK1JHCRiUr
XOh3r+ZFpAdFDE8W2anUvQfxZ8J5wnzJrR/sUcYpgU7OThgX3GplAI727VrCmK9a
5BFRGX+Lcqxt8EfI1JIHkgHQyUWLbMFGudkGqnkK9f860ejt3Os=
=LzWW
-----END PGP SIGNATURE-----

Control: reopen -1
Control: tags -1 + pending

I missed this on review, but please don't close release.debian.org bugs
in uploads. The request isn't complete until the updated package is
actually in stable, at which point the Release Team will close the bug.

Regards,

Adam

This update was released as part of 13.7.